Hashword chrome extension

What is Hashword?

Hashword is a password manager extension for chrome. also, it is password extension. it's a free extension , it has 72 active users since released its first version, it earns an average rating of 4.60 from 5 rated user, last update is 2117 days ago.

What’s new in version 0.6.3?

                No password is ever stored within the extension, or anywhere else for that matter!

How do I use it?

1. Click in the password field on any web site.
2. Click the Hashword button in your browser toolbar (or better yet, assign it a keyboard shortcut in your extension settings).
3. Type your master password and hit enter. Hashword will fill in the password field for you.
4. Log in!

Is Hashword right for me?

That depends -- how paranoid are you?

If you answered "not very", go with the convenience of a more full-featured password manager. I recommend LastPass.

If you answered "WHO WANTS TO KNOW?!", then Hashword is for you! It's for those of us (myself included) that don't trust ANYONE to hold on to our passwords for us. If you're in this category, keep reading.


How is Hashword different from other password managers?

There are basically two types of password managers out there: those that save your passwords, and those that don't.

In the first category are services like LastPass and 1password. They also have sophisticated browser extensions that will fill in your username and password automatically. You can choose passwords as you normally would, or let the extension generate them for you. But whatever you do, these services send your passwords to their servers and store them there. You have to trust them neither to get hacked nor share your information with third parties.

Hashword falls in the second category, along with the tools that inspired it, such as PwdHash and SuperGenPass. These tools generate your passwords on-demand given a master password and the URL of the web site you are visiting. They use a cryptographic hash function to guarantee that the master password cannot be recovered from generated passwords. Hash functions also generate the same password each time for the same site, but different passwords across different sites (with extremely high probability). There is no need to save or store any password anywhere.

I wrote Hashword to address a few major shortcomings of the existing hash-based password tools I could find:

- Many are bookmarklets, which are inherently insecure since they run within the web page you are logging in to. A malicious site could easily steal your master password without you knowing it. A browser extension is not accessible to web sites you visit, so it does not suffer from this problem.

- Other Chrome extensions require a lot of permissions, typically the permission to read the content of all of the web sites you visit. You have to trust the extension developer not to use these powers for evil. Hashword requires absolutely no special permissions.

- Different web sites have different (and conflicting) requirements for passwords -- password length, presence of symbols, need to change your password from time to time, etc. Many of these tools didn't address this, or at least not in a general enough way. Hashword has a few simple options designed to allow you to generate passwords for any web site.


How does it work?

First, Hashword takes the master password you type, appends the domain of the web site you're using it on, and runs the whole thing through the SHA-3 cryptographic hash function (see http://en.wikipedia.org/wiki/SHA-3). This means that you can be confident that your master password is safe, even if an attacker knows you are using Hashword. It also means that, even if you always use the same master password, SHA-3 will output (with absurdly high probability) a unique bundle of bits for each web site.

The input to the hash function also includes a "generation" number for sites that make you change your password from time to time (or if your password is compromised). Just increase the generation number to get a brand new password.

Next, Hashword uses its own algorithm to convert the bits of the hash to a set of letters, numbers, and (optionally) symbols that you can use as a password. As far as I know, Hashword is unique among hash-based password generators in that it uses the ENTIRE hash to generate the password. In other words, there is a one-to-one mapping from hash to password. Other password generators simply truncate the hash once they have the appropriate number of characters. This means that, in theory, the passwords generated by Hashword have the same probability of collision as the hash function itself. The probabilities in play are so minuscule that this probably doesn't matter at all, but the ultra paranoid may find it comforting.            

How to install Hashword?

You could download the latest version crx file or older version files and install it.

Reviews of hashword:

---

Alistair Mees June 1st, 2014

Nice, and it's good that it's open source, but it needs cross-platform compatibility: multiple browsers and the major mobile OS platforms. You can go to the web page to generate a password but that doesn't work so well on a phone. It might be good to allow choice of keywords for sites, defaulting to the domain name, and saved somewhere. That overcomes aliasing problems where a site might have several different names. It also allows the truly paranoid among us to add salt before as well as after password generation. There isn't really a support page. Not everyone has the time and the skill set to read and understand the code.

Read more review & comments of hashword